How to display zero count in a stats table?

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

I'm using the following stats query.

`wso2_wmf(RequestCompleted)`
| dedup eventId
| stats count by request.detailContext 

The problem I have is that it's not displaying zero values for the request.detail.Context field.

If I use '| fillnull value=0' then specify each value from the request.detail.Context field then it does display those values with a zero count.

But the problem with this, is that because I'm being prescriptive in field values, when new field values are being ingested into Splunk for this field, they are not being extracted in the stats table.

I've looked at every post I could find of a similar nature and the solutions provided haven't worked. Could someone perhaps have a look at this and offer some guidance on how I may go about achieving this.

Many thanks and kind regards

Chris

[woodcock · Accepted solution]

This is the Sentinel Search problem discussed (with solution) here:
https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf

[IRHM73]

Many thanks @woodcock.

[woodcock]

Don't thank me, thank @duckfez! 😆 Maybe he will comment and you can UpVote him.

[IRHM73]

Hopefully he will, so can give him the credit aswell.

[MuS]

Might not be the answer, but an idea how to handle the case where the base search does not return events .... read here : https://answers.splunk.com/answers/176466/how-to-use-eval-if-there-is-no-result-from-the-bas-1.html

cheers, MuS

[IRHM73]

Hi @MuS. Doesn't quite work for my circumstances, but it does seem to be a common issue.

Thank you for taking the time to reply.

Many thanks and kind regards

Chris